CVE-2026-114662 obot-platform CVE debrief

Who should care

Defenders responsible for Obot instances, especially those with CLI login flows exposed, should assess exposure and prioritize verification and potential upgrades or compensating controls.

Why it matters

CVE-2026-114662 is a high-severity authentication bypass vulnerability in Obot before 0.26.0 that allows unauthenticated attackers to steal API keys via CLI login token requests, potentially leading to account takeovers and unauthorized access.

• Potential account takeover through stolen API keys
• Bypass of authentication mechanisms in CLI login flows
• Exposure of Obot instances to unauthorized access
• Need for verification of instance versions and compensating controls

Technical summary

The vulnerability in Obot before 0.26.0 allows unauthenticated attackers to steal API keys by exploiting the CLI login token request flow. This is achieved by creating a token request via POST /api/token-request, sending the login link to a signed-in user, and fetching the resulting non-expiring API key. The vulnerability affects Obot instances with CLI login flows exposed, and defenders should prioritize verifying exposure and assessing the feasibility of upgrading to version 0.26.0 or applying compensating controls. The technical impact of the vulnerability is high, and defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Defenders should prioritize verifying exposure of Obot instances, especially those with CLI login flows exposed, and assess the feasibility of upgrading to version 0.26.0 or applying compensating controls.

Recommended defensive actions

• Verify Obot instance versions and exposure of CLI login flows
• Assess feasibility of upgrading to Obot version 0.26.0
• Apply compensating controls for authentication and API key management
• Monitor for suspicious token requests and API key usage
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories and third-party analyses. The vulnerability has been publicly disclosed, and defenders should verify the exposure of Obot instances, especially those with CLI login flows exposed. Evidence limits and source grounding indicate that the vulnerability is high-severity and requires immediate attention. Defenders should review the supplied official advisory or CVE record to validate affected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.